The connection was lost. Trying to connect again.

Post by hex

Earlier in the thread

hex @Hex@kolektiva.social

We are in a very dangerous time, when "AI" security companies are competing to prove that their technology will provide returns on investment. The industry has always been broken. There has always been an incentive to inflate the importance of vulnerabilities, but there was always a risk of burning hard earned trust. In the end, a lot of folks decided it wasn't worth it.

But "AI" companies haven't worked to earn that trust. They have something to prove, right now, or they don't exist. So now everything is critical, "impossible to find without AI," and so on. Blah2shell sells, and now everyone wants their little vuln labeled that way regardless of the complexity or risk.

Burning trust in security is the absolute worst thing you can possibly do in terms of tech. I'm worried about where things are going right now.

There have always been more bugs than we can fix. We've had to triage. If we break that, we flood maintainers until they burn out. Our job is not to fix everything. It's to filter information for the people who do.

But right now I'm reading vuln reports that aren't distinguishing between a 100% reliable and trivial exploit like log4shell and complex memory corruption bugs that are incredibly noisy and basically impossible to exploit with ASLR. ASLR is like 25 years old. You have to do better than a simple buffer overflow now to get a shell.

But people have shit to sell, so we have more noise. Again, "we've put the attenuator on the wrong side of the equation."

· Public

hex @Hex@kolektiva.social

Security engineers, myself included for a long time, tend to have this naive idea that signal is what matters in tooling. If we can just make our signal clean enough, if we can just make sure people only know about what really matters, that devs and operators will fix the right things.

False positive rate becomes a signal. We strive to give only the cleanest information. If we do so, we will be able to get everything fixed. Unfortunately, this is not true.

Any system will incentivize or disincentivize certain behavior. Today, we push devs to make things and operators to manage more stuff.

There is only a certain amount that you can ask them to fix before they burn out. It doesn't matter if it's all real stuff. At a certain volume of work, people stop.

The reason we filter is not because a good enough filter will make sure everything is fixed. We filter because there's just a hard limit on how much can get fixed, so we can only push for important stuff.

· Public

hex @Hex@kolektiva.social

We are seeing the results of a decades long extraction from open source, where markets have driven more to be built while externalizing the cost of review and maintenance.

(If only someone could have told us that invisible labor is devalued under capitalism. If only there could have been some voice there to speak up and tell us that. What a tragedy that no one, decades and decades before the creation of the open source movement, said exactly that thing.)

It's amazing that now, with "AI", capitalism has done the most paradoxical thing of providing support in an extractive way. Even dumping money into security and auditing stuff (the thing we *NEEDED* the whole time, the thing they just never did, the thing that was always written out as "out of scope") is being done in a way that extracts value and destroys the resources on which it relies.

We have to understand that there are invisible commons everywhere. Just because they aren't physical, doesn't mean they aren't real. Open source is a commons. Trust in security is a commons. The collective attack surface of the whole internet is part of the commons of the internet. If these commons aren't managed, they will be mined and destroyed.

One thing capitalism does better than anything else is colonize commons and destroy them. If there's any way to get value out of a commons, capitalism will worm it's way in and hollow the thing out until it collapses.

· Public · edited

Replies

hex @Hex@kolektiva.social

Humans build things and care for each other. This is what we evolved to do. It's something we're driven biologically to do, and we feel bad when we don't do it. That bad feeling is every ancestor who survived through mutual aid burying every (not) ancestor who died from competition.

We build commons. Capitalism is a system that maximizes the extraction of value. Looting commons, be it land or water resources managed for generations, or a tradition of information sharing built up over generations, or systems of trust built up over decades, capitalism is a machine that turns shared wealth and shared costs into centralized wealth and externalized costs.

Capitalist markets are basically a genetic algorithm that uses wealth as a fitness function. One of the properties of these algorithms is that they will have side effects. Destroying commons is an unavoidable side effect. Every possible common will be destroyed until we choose a better algorithm on which to base our society.

· Public · edited